Analysis
- max time kernel
150s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
26/03/2022, 19:56
General
- Target 3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5.dll
- Size 10.0MB
- Sample220326-ynzzvsdbfr
- SHA256 3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5
Malware Config
Signatures
- Detect Numando Payload 2 IoCs
- Numando
Numando is a banking trojan/backdoor targeting Latin America which uses Youtube and Pastebin for C2 communications.
- VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3653d142c22efbd7a64e2247f272d50c299cb2b863a73805e4c528c7d73339d5.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 6963⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1088 -ip 10881⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1088-131-0x0000000002590000-0x0000000003A19000-memory.dmp
memory/1088-132-0x0000000002590000-0x0000000003A19000-memory.dmp
memory/1088-133-0x0000000000B40000-0x0000000000B41000-memory.dmp
memory/1088-134-0x0000000003AA0000-0x0000000003AA1000-memory.dmp
memory/1088-136-0x0000000003AD0000-0x0000000003AD1000-memory.dmp
memory/1088-135-0x0000000003AB0000-0x0000000003AB1000-memory.dmp
memory/1088-137-0x0000000003AE0000-0x0000000003AE1000-memory.dmp
memory/1088-138-0x0000000003AF0000-0x0000000003AF1000-memory.dmp
memory/1088-140-0x0000000002590000-0x0000000003A19000-memory.dmp